CVE-2017-0261: Microsoft Office use-after-free allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is confirmed exploited in CISA KEV with a very high EPSS score, but exploitation requires a user to open a crafted document, which tempers the rating below critical.

What it is

Microsoft Office 2010 SP2, 2013 SP1 and 2016 fail to properly handle objects in memory, a use-after-free (CWE-416) that permits remote code execution. Because Office documents are routinely exchanged and opened, a memory corruption flaw in the document parser is a practical entry point for code execution on the user's machine.

Impact

An attacker who gets a crafted file opened can execute arbitrary code in the context of the current user, giving full control of confidentiality, integrity and availability for that user. If the user has administrative rights, the compromise extends to the whole system.

Attack surface

Reached locally through a malicious Office document or object that the victim must open; the CVSS vector (AV:L, UI:R, PR:N) means no prior authentication is needed but user interaction is required. No network-facing service is involved.

Exploitation

It is listed in CISA KEV (added 2022-03-03), confirming exploitation in the wild, and EPSS is very high at 0.7813 (99.55th percentile). The record does not state whether ransomware campaigns used it; KEV marks known_ransomware_campaign_use as false.

What to do

• Apply the Microsoft security update for Office 2010 SP2, 2013 SP1 and 2016 referenced in the MSRC advisory.
• If patching cannot be completed immediately, disable or restrict the affected document/object handling paths and block untrusted file types at the email and web gateways.
• Run Office with Protected View and disable macros and ActiveX for documents from untrusted sources.
• Remove or upgrade end-of-life Office 2010/2013 installations that no longer receive fixes.
• Enforce least privilege so users do not work with administrative rights, limiting the impact of code execution.

Detection

• Monitor for Office processes (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) spawning child processes such as cmd.exe, powershell.exe or wscript.exe.
• Alert on Office crashing or terminating unexpectedly, which can indicate memory corruption exploitation attempts.
• Hunt for documents containing embedded objects or malformed structures delivered via email or download and correlate with Office execution events.
• Review endpoint telemetry for suspicious file writes or persistence created shortly after an Office document is opened.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.